Anja Ivanovska

**Name of the Vulnerable Software and Affected Versions** Sustainable Irrigation Platform (SIP) versions prior to 5.2.17 **Description** A stored cross-site scripting issue exists where unauthenticated attackers can inject arbitrary JavaScript by providing malicious payloads within program names submitted via HTTP requests. The flaw occurs because the application fails to perform output encoding on rendered program names, allowing the script to execute in the browsers of users who view the affected page. This is further facilitated if a passphrase is not required or if the default passphrase `opendoor` is used. **Recommendations** Update Sustainable Irrigation Platform (SIP) to version 5.2.17 or later. Change the default passphrase `opendoor` to a strong, unique passphrase.

**Name of the Vulnerable Software and Affected Versions** Sustainable Irrigation Platform (SIP) versions prior to 5.2.17 **Description** Cross-site request forgery occurs when a logged-in administrator is lured to a malicious page that issues HTTP GET requests. The system fails to perform CSRF token validation or origin verification, allowing remote attackers to execute state-changing administrative actions. These actions include disabling the passphrase, rebooting the device, deleting programs, or installing plugins. In default configurations, these endpoints are exposed to unauthenticated users because no passphrase is required and the default credential is `opendoor`. **Recommendations** Update Sustainable Irrigation Platform (SIP) to version 5.2.17 or later. Change the default credential `opendoor` and enable a strong passphrase to prevent unauthenticated access to administrative endpoints.

**Name of the Vulnerable Software and Affected Versions** Sustainable Irrigation Platform (SIP) versions prior to 5.2.17 **Description** An issue exists in the restore functionality where the system fails to validate keys within uploaded JSON backup files used to construct file paths. This allows an attacker to perform path traversal, which is a method of accessing files and directories that are stored outside the web root folder. By exploiting this lack of validation, and leveraging either the default passphrase 'opendoor' or the absence of a required passphrase in the default configuration, an attacker can write arbitrary JSON files to unauthorized locations on the system. **Recommendations** Update Sustainable Irrigation Platform (SIP) to version 5.2.17 or later. Change the default passphrase 'opendoor' to a strong, unique passphrase. Ensure that a passphrase is required for the restore functionality in the system configuration.